Unable to modify admin default password

[gulyver13]

Am I the only one worried about it?

The project is very cool, but I am concerned about the possibility that someone may have access to my sensitive data.

[bpatrik]

You need to log in with the original admin user . Create a new user with Admin rights. Login with that user and delete the original admin user.

With an admin user you can delete everyone except yourself. There is no password change option on the site.

see #220

[gulyver13]

Hi @bpatrik,
in the first place thank you for your work! ;)
Can I propose you to create a pull request to modify the default admin password if there is an environment variable (so we are talking about docker container) that replace the default one?

What about that?

[bpatrik]

Thanks :)

I'm "medium" about this suggestion. Do you want to script binging up galleries or why do you need this?
On the security side, I think it is better to force people to delete the default admin user. I might create a banner to force even more.
Furthermore, you would need to have the admin password stored somewhere as a clear text (at least during the first start up as an ENV variable), which is also not the best thing.

On the other hand if you really need this, I'm not super against it. You can also use the config for this. Somewhere here: https://github.com/bpatrik/pigallery2/blob/master/src/common/config/private/PrivateConfig.ts#L334
something like

 @ConfigProperty()
 defaultAdminPassword: string = 'admin';

Use it as Config.Server.defaultAdminPassword in

pigallery2/src/backend/model/database/sql/SQLConnection.ts

Lines 91 to 99 in 6fa96b1

	// Add dummy Admin to the db
	const userRepository = connection.getRepository(UserEntity);
	const admins = await userRepository.find({role: UserRoles.Admin});
	if (admins.length === 0) {
	const a = new UserEntity();
	a.name = 'admin';
	a.password = PasswordHelper.cryptPassword('admin');
	a.role = UserRoles.Admin;
	await userRepository.save(a);

Note that the "Client" config travels to the client side all the time as clear text, while the "Server" config only when an admin logs in an navigates to the settings.